LiquidJS versions 10.25.7 and earlier have a vulnerability where the renderLimit option, designed to limit the time spent in each render() call, can be bypassed by using empty loop bodies in {% for %} or {% tablerow %} tags. Because the per-iteration time check only occurs if the loop body contains at least one template node, an empty loop iterates fully without interruption, allowing a single render call to consume significantly more time than configured (e.g., 2.26 seconds vs. a 50 ms limit). This enables a low-privileged template author to cause a denial of service by stalling the Node.js event loop, impacting availability in multi-tenant environments relying on renderLimit for DoS protection. The vulnerability is fixed in LiquidJS version 10.26.0.

An attacker with the ability to author templates can bypass the renderLimit protection and cause excessive CPU consumption by creating empty loops that iterate over large collections. This leads to denial of service by blocking the Node.js event loop, potentially stalling other requests and degrading availability. There is no impact on confidentiality or integrity.

This vulnerability is fixed in LiquidJS version 10.26.0. Users should upgrade to version 10.26.0 or later to remediate this issue. No official patch or temporary workaround is documented. Until upgrading, avoid relying solely on renderLimit for DoS protection in multi-tenant template environments.